Hacker News Reader

Comment by guappa | Hacker News Reader

It's a reason why I don't really trust signal. They don't want to be recompiled by 3rd party. You must either trust them (or the app stores, which isn't better) or go through the hassle of figuring out how to build it yourself.

View on HN

It's fairly reasonable to discourage people from using random third-party compiled signal variants though. If you can't figure out building it yourself, using the official one will probably be safer.

If they had proper reproducible builds it wouldn't be an issue… Also, why do you think fdroid is more likely to backdoor it than they are themselves?

With fdroid i trust 1 party, by downloading random binaries I have to trust hundreds.

But they do have reproducible builds?

https://github.com/signalapp/Signal-Android/blob/main/reprod...

Except it's out of date…

> using the official one will probably be safer.

Why? The official one can be backdoored and with a gag order you would never hear about it

Not trusting signal's build and building it yourself is a reasonable thing to do.

Not trusting signal's build and then turning around and trusting some third party build seems strange. The official build probably has more eyes on it, and signal has more reputation to lose.

You don't need to run the binaries at all if you don't want, you can just get the standard VPN configs and use your OS's network stack. You won't get all the fancy features, but otherwise it works fine.

Uh?

Good question.

I'd start here if I were you: https://protonvpn.com/support/wireguard-configurations

The context was Signal

Oof. Thanks, I must have been switching tabs too quickly.

Reply on news.ycombinator.com